Business for South Africa · supplies, fake news, lack of information on virus The risk scales...

Business for South AfricaCOVID-19 Response

Dynamic Risk Assessment Findings

April 2020

Risk FindingsBusiness for South Africa COVID-19 Response

Fifteen major strategic risks were identified by Businessfor South Africa (B4SA) in the fight against COVID-19.These risks were assessed by B4SA survey participantsfor severity and likelihood but it soon became apparentthat there was considerable interconnection betweenthem and they formed a network of risks. As such,mitigation cannot be approached on a piece-meal basis: itneeds to be addressed as an interactive, dynamicenvironment in which each component’s effect on theothers is taken into account. This report addresses this.

The most severe and likely individual, or discrete risks are:

– Economic impact / damage. Lockdown economicallyunaffordable

– Insufficient healthcare, workforce, infrastructure andequipment

– Loss of livelihoods, social unrest, riots

– Sustainability and practicality of lockdown rules in SAcontext

The risk combinations (risk clusters) most expected to beencountered, whose impact would be felt within onemonth if they occurred, are permutations of:

– Sustainability and practicality of lockdown rules in SAcontext

– Loss of livelihoods, social unrest, riots

– Economic impact / damage. Lockdown is economicallyunaffordable

– Inability to maintain law and order

– Breakdown in the social compact betweenGovernment, business, labour and society

– Failure in critical infrastructure – energy, water,sanitation, gas, IT

– Supply chain security for essential services and goods

The risk with the greatest impact or flow-on effect ontoevery other risk, and therefore the single risk with thediscrete potential of avoiding the combinations above, isInability to maintain law and order. Mitigate it, and itreduces the likelihood / severity of every other risk -directly or indirectly.

Economic impact / damage. Lockdown economicallyunaffordable is the next most influential risk, followed byLoss of livelihood, social unrest, riots and Continued

Government service delivery respectively. The level ofinfluence drops after the latter risk.

If the risk system as a whole is not mitigated, it will end inLoss of livelihoods, social unrest, riots. This is the numberone concern for business, attracting a higher concern thanthe economy itself. Being systemically the mostvulnerable, its optimal mitigation comes from the mostinfluential risk: Inability to enforce law and order.Mitigating this risk serves a three-fold purpose:

– It optimally protects the economy which, in turn, willspread throughout the network to mitigate every otherrisk in the most efficient manner

– It will maximally safeguard the economy from pivotingto a negative, destructive downward spiral draggingevery other risk with it into a calamitous, collectiveoutcome

– It offers the best possible protection against people notbeing able to generate income, losing their livelihoods,with unemployment mostly youth soaring, triggering ahigh risk of social unrest / riots that may becomepolitical. Widespread hunger, domestic violence,mental health, impact on education, civil disobedienceand business / property risk

The next ‘domino to fall’ after Loss of livelihoods, socialunrest, riots is expected to be Economic impact / damage.Lockdown economically unaffordable. This would lead to aBreakdown in social compact between Government,business, labour and society and, ultimately, an Inability toenforce law and order.

If these risks are allowed to occur at the same time, theywill trigger an existential, calamitous risk to the country.As a result they cannot and should not be allowed tospread to each other. It is of the utmost importance.

It is helpful to consider the risk of Economic impact /damage. Lockdown economically unaffordable. This riskfeatures as number two in terms of influence onto everyother risk. But it is also the second ranked risk in terms ofbeing affected by every other risk in the network. As such,it is an unstoppable force of momentum. It will eitherpropel every other risk to an overall positive outcome, or itcan pivot in an instant to impel every other risk into adownward spiral to end up with the most vulnerable risk:Loss of livelihoods, social unrest, riots. It offers no middleground.

Executive summary


Further risks that are more influential in mitigating otherrisks than what they are themselves affected by thoserisks include:

– Continued Government service delivery

– Failure in critical infrastructure - energy, water,sanitation, gas, IT

– Lack of structured interface - Government, business,labour and civilians

These risks are systemically mitigation accretive: theymitigate on the overall risks more than on what is spenton their own mitigation, to reduce the overall risks beyondtheir individual mitigation. As such, they present powerfullevers to Government to combat the current situation withmaximum effect.

A risk that was identified as a left field disruptor that cantrigger a system-wide outbreak is Fair, transparent andequitable distribution of social funding. Specific attentionshould be paid to it: any impression, whether created bysocial media, rumour, innuendo or otherwise (even fakenews) can prompt it to trigger risks within the clustersidentified earlier.

Lastly, risks that are not expected to be connected andthat can be discretely delegated are:

– Defining ‘new normal’/vision /structural shifts required

– Another significant event occurring

– Regional / cross provincial lockdown impact exertadditional strain

Executive summary


Why Dynamic Risk Assessment (DRA) ?

1. Background, scope and approach

The science of risk management has learnt, on 18 globallysignificant occasions post 1970, that risks affect eachother and seldom occur neatly in isolation. Instead, theyconjoin, frequently producing consequences far worsethan any single risk portended. Examples includeaeroplane disasters, nuclear meltdowns, oil rigcatastrophes and pandemics.

As a result the diligent management of risks needs toinclude attention being paid to their interaction on eachother, as a collective, complex adaptive system.

Extensive research into the matter found themethodology currently best suited to do this beingnetworks. DRA combines the best that a number ofsciences have to offer to produce a cognitive risk networkthat best represents experts’ thinking - the wisdom ofcrowds – which has been found to be more accurate thana single expert can produce.

The 15 strategic risks in this report and used for the DRAprocess were based on the risk registers collated by B4SAand selected, individual interviews with key participants.The risks’ severity and likelihoods were assessed byparticipants with reference to predefined logarithmic andprobabilistic scales. The risks’ interconnectedness wereobtained from bias-controlled, Systems II inducing expertelicitation techniques.

Twenty five participants provided input data on 10 and 11April 2020, making the results and findings robust andrepresentative. These were presented to B4SA and theCOVID-19 Steerco prior to the finalisation of this report.

The approach adopted in this report draws on oneapplication of graph theory. Other methods / alternativeapproaches may result in different results. A range ofanalyses and information should be considered beforemaking decisions.

Motivation Strategic risk register

Survey and results Limitations

2. Risk definitions and risk scales


Table 1: Risk definitions

2. Risk definitions and risk scalesThe 15 strategic risks in this report and used for the DRA process were based on the Risk Registers collated by B4SAand selected, individual interviews with key participants. The risks’ severity and likelihoods were assessed by participantswith reference to pre-defined logarithmic and probabilistic scales. The risks’ interconnectedness were obtained frombias-controlled, Systems II inducing expert elicitation techniques.

No. Item Description

1 Another significant event occurringPossibility of another significant event at the time of lock-down / responding to

COVID-19 / rebuilding economy. Reduced capacity to deal with it

2Breakdown in social compact between

Government, business, labour and society

Containment in densely populated / informal areas not possible. Citizens no longer heed Government for ‘greater good’, ineffectual communication,

residential area spill over, trust dissipates, ‘curve flattening’ not understood

3 Continued Government service deliveryGovernment spheres’ liquidity strains interrupting supply of critical

infrastructure, services such as water, sanitation, electricity. Exacerbated by electioneering, strike action, multiple events occurring simultaneously

4 Defining ‘new normal’ / vision / structural shifts required

Need to determine what long-term industries / economic structural change / reform should look like. Balance between safety, security, law and order, basic needs (food and water), profit and people. Lack of unified rebuild focus (gov.,

business, society, trading partners). Seizing the moment vs complacency

5 Economic impact / damage. Lockdown economically unaffordable

Economy fragile and structurally flawed. Stimulus constraints More downgrades Sustainability of fiscal support. Reduced economic activity,

confidence. Businesses highly geared Business failures. Unemployment. Structural reforms and rebuild too slow, difficult. Reduced trade and

international protectionism

6 Failure in critical infrastructure - energy, water, sanitation, gas, IT

Lack of critical resources. Cyber-attacks. Knock-on effects of lockdown measures. Eskom loadshed. Lack of liquid fuels, gas and power. Collapse of

communication infrastructure, SOE pressures

7 Fair, transparent and equitable distribution of social funding

Challenges with timing, qualification criteria, manner of distribution, identification and vetting of recipients, communication, bureaucracy

8 Inability to enforce law and order

Limitations in SAPS and SANDF. Inability to enforce interventions, law and order. Organised crime and corruption, increased criminality, domestic and public violence, premises and property damage, strained police and judicial

system, inappropriate law enforcement. Political propaganda linked to service failures

9 Insufficient healthcare, workforce, infrastructure and equipment

Severely constrained resources. Impact of lock down on medical supplies. Contact tracing delays. Lack of critical supplies, facilities (beds, ICUs,

ventilators, masks, test kits). Concentration of population with suppressed immunity. Inability to scale

10Lack of structured interface -

Government, business, labour and civilians

Disjointed, poor collaboration and communication between Government (including National Command Council), business, SMMEs, labour and civil society. Not applying lessons learned and benchmarking of other countries

11 Leadership / command incapacitated by COVID-19

Leadership / command team members incapacitated. Delayed decisions and responses, public panic / hysteria. Overseas reaction


Table 1: Risk definitions (cont.)

No. Item Description

12 Loss of livelihoods, social unrest, riots

Inability to flatten curve extends lockdown. Cannot generate income / loss of livelihoods. Unemployment soars, mostly youth, high risk of social unrest /

riots – may become political. Hunger, domestic violence, mental health, impact on education, civil disobedience. Business / property risk

13 Regional / cross provincial lockdown impact exert additional strain

Inadequate healthcare / infrastructure in neighboring countries. Porous Boundaries. Provincial migration to access services. Unsynchronised

lockdowns in neighboring countries. Economic and health migrants, increased crime and xenophobia, increase in rural to urban migration

14 Supply chain security for essential services and goods

South Africa’s import reliance, import restrictions. Inability to move essential goods. Logistic / interpretation problems at ports, depots. Backlogs, regulatory hurdles and poor communication to public, interconnectivity and slowdown of

entire supply chain, shortages - food

15 Sustainability and practicality of lockdown rules in SA context

Non-adherence / non-compliance to lockdown rules, impossibility thereof in townships, rural and informal settlements, inadequate housing and shelter, lack of water and sanitation, transport challenges, inadequate emergency

supplies, fake news, lack of information on virus

The risk scales below were used by DRA survey participants to assess the severity, likelihood and velocity of the risks.

Table 2: Severity - potential loss / impact rating

Impact factor

Score General Media and response Stakeholders Resources Humanitarian

Catastrophic 100

Disaster leading to the collapse of the

economy, infrastructure and

services

Major negative media coverage with prolonged international, regional and

national condemnation

Fundamental disengagement of the

majority of international and national stakeholders

Breakdown of the social compact between

Government, Business, Labour and Civil Society

Complete loss of trust and confidence in the

Government

Complete disruption of critical infrastructure, supply chain, service

delivery and collapse of business operations

Extensive and widespread loss of life and impact on

livelihoods resulting in widespread

unemployment, hunger, deprivation and impoverishment

Breakdown in law and order, rampant civil and

social unrest, unprecedented crime and

violence

Critical 30

Critical events which can be endured but which may have a prolonged negative

impact and extensive consequences

Extensive negative media coverage with some

international criticism, regional and national public

concern

Significant disengagement of international and national

stakeholders

Damage to the social compact between


Substantial loss of trust and confidence in the

Government

Severe interruption of critical infrastructure, supply chain, service delivery and business

operations

Severe and widespread loss of lives and material

impact on livelihoods, significant unemployment, disruption of law and order

Significant increased civil and social unrest, crime

and violence

Serious 10

Major events, which can be managed but

require additional resources and effort

Negative media coverage with some national criticism and limited

regional public concern

Disengagement of some important stakeholders

Strain on the social compact between


Reduced trust and confidence in Government

Reduction of critical infrastructure, supply chain,

service delivery and business operations

Significant loss of life that may be widespread or

dispersed.

Impact on livelihoods, increased unemployment

and social discontent

Significant 3Event which can be

managed under normal conditions

Limited negative media coverage with national

public concern

Damage to relationship with some stakeholders

Limited impact on the social compact between Government, Business, Labour and Civil Society

Limited impact on trust in Government

Some interruption in business operations,

supply chain constraints and strain on critical

infrastructure

Some loss of life Difficult but endurable impact on

livelihoods

Minor 1

Events that should be monitored but no immediate action is

required

Limited adverse media coverage

Limited relationship damage

No impact on the social compact between


Minimal disruption of operations

Limited loss of life

No serious impact on livelihoods


Table 3: Likelihood / probability of occurrence

Likelihood factor DescriptionProbability of single occurrence within 12

months

Almost certain The risk is almost certain to occur under the current circumstances 100.0%

Likely More than an even chance of risk occurring 50.0%

Possible A possible chance that the risk will occur 25.0%

Unlikely Unlikely to occur 12.5%

Rare A risk that will only occur in very rare circumstances 6.3%

Time horizons (months)

0.25 0.75 1.5 3 6 12 24

Table 4: Velocity rating table

3. Key DRA findings


3. Key DRA findingsThe South African Government is responding to the COVID-19 pandemic. Critical sectors across Government, health,labour, business and civil society have come together to address the challenges. Business for South Africa (‘B4SA’)initiated a Dynamic Risk Assessment (DRA) to assist in understanding the interconnected risk landscape.

Key risks foreseen by B4SA that impact South Africa were identified through the application of four criteria: severity,likelihood, velocity and interconnectedness. Based on these criteria, the salient findings below capture the risks whichwere identified as important:

Figure 1: Likelihood and severity of individual or discrete risks

The most severe and likely individual, or discrete risks are Economic impact / damage. Lockdown economicallyunaffordable; Insufficient healthcare, workforce, infrastructure and equipment; Loss of livelihoods, social unrest,riots and Sustainability and practicality of lockdown rules in SA context.

Importantly, these risks do not constitute separate, discrete threats; on the contrary they interact to affect and influenceeach other, so that focusing on one individually may trigger unintended consequences elsewhere in the riskenvironment. It is therefore important to determine how the risks manifest as a dynamic system in order to identify themost optimal ways to mitigate the totality of the threats, individually and collectively, that they present.

The science currently best suited for this task is network theory:


Figure 2: Causal linkages between discrete risks identified by participants through network theory

A networked analysis of the risks allows the identification of risk clusters; that is the combinations of risks mostexpected to occur in combinations by triggering each other if any one of them was to occur. The combinations identifiedare:

Figure 3: Clusters from network most expected to be encountered

*The lines show the connectivity between risks and the arrowheads the strength and direction of the risk connection

*5 risk clusters defined on next page


The risk clusters present the scenarios most expected to be encountered in future. They each have a velocity of onemonth – that is from the time any one risk in a cluster is triggered to the time that every risk in the cluster is triggeredand their combined impact is felt, is one month:

All five clusters have aggregate severities at catastrophic levels. The cluster with the highest expected loss and thegreatest aggregate likelihood (almost certain) consists of Sustainability and practicality of lockdown rules in SAcontext; Loss of livelihoods, social unrest, riots and Economic impact / damage. Lockdown is economicallyunaffordable.

The other four risk clusters include the risks of Sustainability and practicality of lockdown rules in SA context; Lossof livelihoods, social unrest, riots; Inability to maintain law and order; Breakdown in the social compact betweenGovernment, business, labour and society; Failure in critical infrastructure – energy, water, sanitation, gas, IT aswell as Supply chain security for essential services and goods.

With these scenarios most expected to be encountered in future, it raises the question of how they can be bestprevented.

To answer this question most efficiently, we must take account of the interaction of all the risks onto each other. Again,network theory is helpful as it can identify the risks with the greatest flow-on consequences onto all the others:

Figure 4: Clusters of discrete risks most expected to occur together, and their velocities


Inability to maintain law and order is the most central (systemically influential) risk. That is, it is the risk with the most powerful flow-on, pervasive causation onto every other risk. In other words, it is the single risk with the greatest ‘reach’ throughout the entire network of risks. Mitigate it, and it reduces the likelihood of every other risk being triggered -directly or indirectly – despite it not being in the most severe, most likely quadrant in the first graph. Its system-wide influence surpasses its individual threat level; potent as that is.

This means that the optimum mitigation of all the risks as components of a complex, adaptive system should start with the mitigation of Inability to maintain law and order; its individual mitigation will not be contained to it, but propagate maximally to every other risk with the greatest effect from all the options of where to start the mitigation of the risk environment.

Economic impact / damage. Lockdown economically unaffordable is the next most influential risk, followed by Loss of livelihood, social unrest, riots and Continued Government service delivery respectively. The level of influence drops after the latter risk.

Up to now the analysis has addressed the most threatening individual risks, the scenarios most likely to be encountered, and the rank order of mitigation that will most effectively permeate throughout the complex, adaptive system to reduce every risk with the maximum effect and pay-off on money spent.

However, it is now useful to let the collective contagion run its full course in order to see what the ultimate outcomes would be if no intervention takes place - the absolute worst case scenario as it were:

Figure 5: Rank order of influencing effects of each risk onto every other risk


If the expected causation between the risks is allowed to run its full course, meaning there is no (or no effective) mitigation of the risks, or risk mitigation is focused on the ‘wrong’ risks, the ultimate result is expected to be Loss of livelihoods, social unrest, riots. The next ‘domino to fall’ will be Economic impact / damage. Lockdown economically unaffordable, to be followed by Breakdown in social compact between Government, business, labour and society and Inability to enforce law and order.

Were these risks allowed to occur at the same time, they will culminate into an existential, calamitous risk to the country. As a result, they simply cannot and should not be allowed to spread to each other. It is of the utmost importance.

With the optimal mitigation risks now identified, and the potential end outcomes articulated, it is time to consider the dynamics of the network of interconnected risks from its ‘systemic beginning’ to its ‘systemic end’:

Figure 6: Rank order of vulnerability of each risk being influenced from every other risk


It is useful to start the analysis of this table with Economic impact / damage. Lockdown economically unaffordable. This risk appears as number two in both the influential and the vulnerability rankings. Meaning it is an unstoppable force of momentum; it will either propel an overall positive outcome, or it will pivot in an instant to impel a downward spiral all the way to the most vulnerable risk of all: Loss of livelihoods, social unrest, riots. As such, it offers no middle ground. Moreover, it can change from a force for good to a force for destruction in an instant, and without warning.

Table 5: Rank order of systemic influence and vulnerability of each risk

Emitterrank

Emitter / influential risk (Risks with the most causal influence on other

risks in descending order)

Receiver rank

Receiver / vulnerable risk (Risks most vulnerable / susceptible to flow-on

effects from other risks)

1 Inability to enforce law and order 1 Loss of livelihoods, social unrest, riots

2Economic impact / damage. Lockdown economically unaffordable

2Economic impact / damage. Lockdown economically unaffordable

3 Loss of livelihoods, social unrest, riots 3Breakdown in social compact between Government, business, labour and society

4 Continued Government service delivery 4 Inability to enforce law and order

5Failure in critical infrastructure - energy, water, sanitation, gas, IT

5Sustainability and practicality of lockdown rules in SA context

6Sustainability and practicality of lockdown rules in SA context

6Supply chain security for essential services and goods

7Supply chain security for essential services and goods

7 Continued Government service delivery

8Lack of structured interface - Government, business, labour and civilians

8Insufficient healthcare, workforce, infrastructure and equipment

9Leadership / command incapacitated by COVID-19

9Failure in critical infrastructure - energy, water, sanitation, gas, IT

10 Another significant event occurring 10Lack of structured interface - Government, business, labour and civilians


From the table on the previous page it can be seen that the number one concern for business is the wellbeing of people: Loss of livelihoods, social unrest, riots. It is defined as:

“Inability to flatten curve extends lockdown. Cannot generate income / loss of livelihoods. Unemployment soars, mostly youth, high risk of social unrest / riots – may become political. Hunger, domestic violence, mental health,

impact on education, civil disobedience. Business / property risk.”

That is, it attracted a higher vulnerability (systemic concern) from business than the economy itself. Being systemically the most vulnerable, or collectively most susceptible risk, its optimal mitigation will come from the most influential risk: Inability to enforce law and order. Mitigating the latter risk therefore serves a three-fold purpose:

– It will optimally protect the economy which, in turn, will spread in a positive manner throughout the network to mitigate every other risk in the most efficient manner

– It will maximally safeguard the economy from pivoting to a negative, destructive downward spiral dragging every other risk with it into a calamitous, collective outcome

– It offers the best possible protection against people not being able to generate income, losing their livelihoods with employment soaring, mostly youths, triggering a high risk of social unrest / riots that may become political. Widespread hunger, domestic violence, mental health, impact on education, civil disobedience and business / property risk

Additional individual risks that are more influential in mitigating other risks than what they are affected by those risks (they appear higher in ranking on the left hand side of the table on the previous page than on its right hand side) include Continued Government service delivery, Failure in critical infrastructure - energy, water, sanitation, gas, IT, as well as Lack of structured interface - Government, business, labour and civilians.

These risks, then, are systemically mitigation accretive; they mitigate more than what is spent on their mitigation, to reduce the overall risks beyond their individual mitigation. As such, they present powerful levers to Government to combat the current situation with maximum effect.

Where do surprises in the network lurk? What can come from left field to disrupt a carefully balanced and poised situation? By analysing the network to identify the weakly linked risks with disastrous aggregate outcomes, the risk that was identified as a left field disruptor was Fair, transparent and equitable distribution of social funding.

Specific attention should be paid to it: any impression, whether created by social media, rumour, innuendo or otherwise (even fake news) can trigger it, to trigger risks within the clusters identified earlier.

Which risks, or tendrils, are not

– Individually significant or likely?– High in expected velocity?– Highly connected, highly influential or influenced?– Posing a strongly linked, high severity threat?

Or, to state it differently, which risks have not been caught in any of the analyses discussed so far?


The tendrils, or risks that are expected to be less connected (i.e. not systemically threatening), unlikely to be individually significant or likely, low in in velocity and not forming part of a weakly linked, severe outcome are Defining ‘new normal/vision/structural shifts required; Another significant event occurring and Regional / cross provincial lockdown impact exert additional strain. These risks can be delegated and reported on by those entrusted with their mitigation. Not being individually or systemically important, they should not occupy the thinking of the highest levels of Government at this time.

Note that Insufficient healthcare, workforce, infrastructure and equipment was recognised as one of the top three risks in terms of being both catastrophic and likely. However, because it is not as central in the risk network in terms of connectivity, it may be best managed discretely by competent and capable healthcare leaders who are ‘freed- up’ to get on with managing this specific risk, whilst top leadership attends to ensuring the stability of the network.

Figure 7: Tendrils

4. Most pervasive risk emitters


Figure 8: Illustration if the central risk emitters / most influential risks are not managed

4. Most pervasive risk emitters

If the central risk emitters or the most influential risks (red circles) are not managed then there will be a flow through toother connected risks (blue circles).


Figure 9: The most influential risks according to their rank order

This graph shows where the central emitter / most influential risks sit on the severity and likelihood graph.

Under traditional Enterprise Risk Management (ERM) (without seeing connectivity and the network effect) it is possiblethat emphasis would be placed predominantly in top right quadrant as opposed to those risks in green which are themost influential risks in the network.

5. Most convergent risk receivers


5. Most convergent risk receivers

Figure 10: Illustration of the most convergent risk receivers

Correspondingly, when risks arise in the network, the most convergent risk receivers (or those risks most influenced oraffected) suffer contagion. These highly influenced risks are shown in the network diagram below in numerical order i.e.the risk that is most influenced or impacted upon when other risks arise is Loss of livelihoods, social unrest, riots.

6. Weakly linked, high severity risks


6. Weakly linked, high severity risksTable 6: Weakly linked, high severity risks

Cluster Risks Threshold Percentage Risk Rating

11

Breakdown in social compact between Government, business, labour and society,

Economic impact / damage. Lockdown economically unaffordable, Fair, transparent and equitable distribution of social funding, Loss of

livelihoods, social unrest, riots

0.52 0.54

25

Economic impact / damage. Lockdown economically unaffordable, Fair, transparent and equitable distribution of social funding, Loss of livelihoods, social unrest, riots, Sustainability and

practicality of lockdown rules in SA context

0.48 0.59

One risk, Fair, transparent and equitable distribution of social funding, not in the top five risk clusters, is weaklylinked to risks in the top five clusters.

As such, if it is triggered, it can spread to a number of individual risks in the top five clusters, thus triggering a combinedclustered outcome with catastrophic consequences.

It is analogous to an extreme (statistical) tail event, albeit it on a forward-looking basis.

It follows that the risk should be carefully managed / mitigated, so that it does not occur. Or, if it occurs, its contagion toother risks can be interrupted / severed decisively.


Appendices


Term Description

Dynamic risk assessment (DRA)

DRA methodology looks beyond the conventional two dimensional approach to depicting risk, typically based solely on grading individual risks according to their likelihood and severity, and takes a four-dimensional view by including considerations of risk interconnectedness and velocity. This enables consideration of the contagion effect of risk

Most convergent risk receivers

Risks most vulnerable / susceptible to flow-on effects from other risks

These risks are significant in that they are triggered or made worse by other risks due to their centrality by effect

Most pervasive risk emitters

Risks with the most causal influence on other risks

These risks are significant in that they have greater potential to trigger or make other risks worse in the network due to their centrality by cause

Risk clustersRisk clusters are groups of risks that have been identified by the survey participants as particularly strongly connected and therefore should be considered in combination for risk management purposes

TendrilsThese risks are less significant in that they are individually benign and are neither systemically influential, or influenced

Traditional key risks Based on severity and likelihood measures of risk

VelocityVelocity measures the speed at which a risk is expected to have a material impact on onset

Weakly linked, high severity risksCombinations of risks that display weak links to each other but pose disastrous aggregate severities

A. Glossary


B. Network methodologyBackground theory

The Global Financial Crisis (GFC) highlighted again thatcommon risk management tools can be ineffective atforewarning company losses or failures. In our view thisreflects several factors, including:

– Common risk management tools, such as riskregisters, encourage organisations to focus on risksindividually and do not capture the interconnectionsbetween risks. Research into company failureshighlights that, typically, a number of related risks needto materialise for a company to suffer catastrophic lossor failure. Therefore understanding the connectionsbetween risks is necessary to prevent catastrophiclosses / failure

– Common risk management tools often do not focus onrisks that are systemically important. Systemic risks arethose risks that are more likely to cause a cascadingimpact. Understanding systemic risks is importantbecause these risks are more likely to be central tocompany failures and losses

– History indicates that the scenarios that causecatastrophic losses are unlikely to be the cause of thenext catastrophic loss. This reflects a range of factorsincluding changes to technology, globalisation andlearning / adjustments from past events

Graph theory

Graph theory is the mathematical theory of graphs as arepresentation of pairwise relationships (termed edges)between pairs of (abstract) objects or nodes. Historically,it has been used in a number of different disciplinesincluding physics, engineering and sociology. When graphtheory is used as a mathematical structure to representthe causal relationships between risks, graph theory’sformal methods provide

– A context with which to carefully define the systemicimportance of risks and other topological features ofthe network

– Algorithms to determine the systemic importance ofindividual risks and the systemic features of the overallnetwork

– A solution to the limitations of siloed approaches to riskmanagement

Graphical representations of risk relationships are afeature of the annual World Economic Forum Risk Reportsand in particular the Bank of England, and Federal Reservehave used graph theory to identify and analyse theconnectivity between major risks. More recently, it hasbeen applied to finance and, within this context, used toanalyse the potential systemic relationships betweenindividual risks.

Applying graph theory to survey responses

A number of valid approaches can be used to determinethe graphical representations and statistics. Wherealternative approaches exist, we have adopted anapproach that, in our view, includes consideration offactors consistent with an application to risk management.For example, Bonacich Centrality has been adopted tomeasure the systemic importance of individual risks as itincludes consideration of connections beyond theimmediate connections (i.e. “flow-on impacts”). Furtherdetail of the methodology adopted for each networkmeasure is outlined in the sections where thesemeasures are introduced.

A key challenge in applying graph theory to the surveyresponses is converting the responses into quantitativemeasures for each risk. The following approach wasadopted:

– Only complete responses are included in the analysisto reduce the potential for bias within the results

– The connections are determined by summing thenumber of times another risk was identified as beingmade more severe or likely to occur by the risk inquestion. The systemic interconnectedness chartshows only those connections above a certainthreshold determined to optimise the visualisation ofthe output, and to differentiate between “signal” and“noise”

– The responses from each participant for severity,likelihood and velocity are converted into values in theunits of measurement using the risk scale calibrationmethodology (described in the following section) andeach metric represented by an arithmetic average. Forpresentation in the charts, these averages aredisplayed in the same risk scales used to elicit thesurvey data

Limitations of approach

The user should acknowledge that graph theory is but oneapproach to analyse the key risks, and that other analysesmay also be appropriate. Limitations of the approachadopted include:

– The analysis is based on survey data which representsthe opinions of the survey respondents

– We have not independently verified the surveyresponses

– The approach adopted is based on one application ofgraph theory. Adopting alternative approaches mayresult in different results

– A range of analyses should be considered beforemaking decisions


Overview of risk - Background theory

The collection of categorical data is very common instatistics. However categorisation of continuous data isoften misapplied particularly in the case where the datahas a natural significant level of numerical uncertainty.Used this way categorisation does not repair the issues ofuncertainty but instead conceals it.

Where estimation has uncertainty, categorisation intobands has the effect of prematurely reducing theinformation content of the collected data. There are veryfew situations where a priori cut points are known for realvalued variables and these unnecessarily implydiscontinuous transitions in the phenomena studied.Under analysis this can lead to perverse situations whereinference can be driven by the selection of cut pointsalone. It is for this reason Dynamic Risk Assessmentexplicitly collects continuously-valued risk metric data viaan analogue-style interface.

The lines on the severity-likelihood plot and velocitycollection interfaces acts as reference points such as on aruler. The ability to smoothly move the position of pointsallows survey participants to consistently order allinformation, to re-visit earlier estimates, and throughoutthe process have a visual summary of their responses.The random ordering of risks with respect to everyparticipant reduces any systematic data quality effectsdue to survey fatigue.

Log-linear risk scales

Recent research suggests that in the absence of formalmathematical education the human conceptualinterpretation of numbers naturally default to a logarithmicdescription. This is not surprising as the Weber-FechnerLaw suggests that this may have a biological origin withthe senses of brightness, sound, pain and chemicalresponse in biological systems also being logarithmic. Inaddition this may have evolved because of allcategorisation schemes it is the unique one whichreduces relative error in magnitude estimation.Consequently only scales similar to these allow surveyparticipants of all numerical abilities to estimate riskmetrics consistently over the many orders of magnitudedifference in event rate and severity usually encounteredin enterprise risk management. Serendipitously the use ofexpected loss as a determinant in risk-based pricing andactuarial theory mathematically support the use oflogarithmic risk scales.

Historically, the use of logarithmic scales for the depictionof risk magnitude is not exclusive to KPMG. Log-riskscales are also a common practice in risk modelling inEngineering. Even so, the principle scientifically-supportedbenefit of the KPMG methodology is that log scales

collect better data from expert participants in addition toincreasing their comprehension when depicting it to them.

Client specific risk scales

Informed by the breadth of the client's own risk scale alogarithmic risk scale can be defined specifically for them.The survey tool then allows the survey data to becollected calibrated to this standard ruler as informed bythe client's own risk measurement methodology orpolicies, or where absent a best practice proxy scaleprovided.

C. Risk scale calibration methodology


D. Risk cluster scoring methodologyRisk clusters - principles

In graph theory groups of strongly related risks are calledrisk clusters. These are relevant because company losses/ failures are typically the result of a number of relatedrisks materialising at the same time.

Risk clusters are determined by analysing a number offactors, including strength and number of connectionsbetween a small group of risks. All risks within a clusterare likely to trigger / make more severe or be triggered /made more severe by other risks in the cluster.

Risk clusters

Risk clusters are determined using the followingapproach:

– An algorithm identifies potential risk clusters based ona subset of risks that meet minimum criteria. It mayidentify multiple clusters with similar risks. Forexample, one potential cluster could be identified withfour risks while another potential cluster could be thesame four risks plus another risk

Risk cluster score aggregation

There are a number of alternative approaches in graphtheory to aggregate risk nodes and produce an aggregaterisk score for a risk cluster. However, there is nouniversally accepted approach when non-parametric,ordinal risk ranking scores are used.


Inherent limitations

This report has been prepared as outlined in theBackground and Scope Section. The services providedin connection with this engagement comprise anadvisory engagement which is not subject to AuditingStandards or Standards on Review or AssuranceEngagements, and consequently no opinions orconclusions intended to convey assurance have beenexpressed.

The findings in this report are based on data output fromthe survey undertaken by B4SA.

No warranty of completeness, accuracy or reliability isgiven in relation to the statements and representationsmade by, and the information and documentationprovided by respondents. In particular, we have notindependently verified the survey data responses.

KPMG has indicated within this report the sources of theinformation provided. We have not sought toindependently verify those sources unless otherwisenoted within the report.

KPMG is under no obligation in any circumstance toupdate this report, in either oral or written form, forevents occurring after the report has been issued in finalform.

The findings in this report have been formed on theabove basis.

Third party reliance

This report has been prepared for illustrative purposes.KPMG, nor any member or employee of KPMG,undertakes no responsibility arising in any way fromreliance placed by a third party on this presentation. Anyreliance placed by a third party is that party’s soleresponsibility.

E. Reliance and limitations


Norman Mbazima

+27 64 811 7521

[email protected]

[email protected]

Martin Kingston

+27 82 372 5225

[email protected]

[email protected]

Kashmira Bhana

+27 83 443 0272

[email protected]

[email protected]

Dr Kerry Jenkins

+27 83 297 1197

[email protected]

Dr Andries Terblanche

+61 2 9335 7570

[email protected]

F. Contact details

mailto:[email protected]








Business for South Africa · supplies, fake news, lack of information on virus The risk scales...

Documents

Transcript of Business for South Africa · supplies, fake news, lack of information on virus The risk scales...